Affected Systems

OpenAI, Anthropic, and Google reasoning APIs (GPT-5.6 Luna, Claude Haiku 4.5, Gemini Robotics ER-1.6). Affects developers who published raw agent logs containing encrypted reasoning objects. Cross-session replay allowed weaker models to decode encrypted reasoning blocks from stronger models within the same provider family.

Exploitation Status

Proof-of-concept demonstrated by researchers. 704 distinct privacy artifacts recovered from 6,708 public agent trajectories, including 62 API keys, 33 passwords, 24 access tokens, and 7 private keys. Researchers state attacks no longer reproducible as of August 2026 after vendor mitigations. No evidence of malicious exploitation in the wild.

Business Impact

Organizations using affected reasoning APIs may have exposed secrets embedded in encrypted reasoning blocks if agent logs were published or shared. Attack required obtaining an encrypted reasoning block (e.g., from published agent logs) and API access to a compatible model from the same provider. 64 artifacts appeared only in hidden reasoning, not visible traces, meaning sanitization of readable conversation text was insufficient. Invisible prompt injection also possible via crafted opaque reasoning blocks. No CVE assigned. Vendors have not publicly acknowledged the flaw; mitigation status relies solely on researcher statements.

Urgency

🟡 Within a week

Recommended Actions

  • Audit all published agent logs, API transcripts, and shared traces for OpenAI, Anthropic, and Google reasoning APIs; remove or rotate any API keys, passwords, tokens, or private keys that may have been included in encrypted reasoning blocks
  • Strip encrypted reasoning objects (OpenAI encrypted reasoning items, Anthropic encrypted signatures, Google encrypted thought signatures) from agent logs before sharing or committing to repositories
  • Review code repositories and documentation for raw API transcripts containing opaque reasoning fields; sanitize or remove even if visible text was previously cleaned
  • Implement policy to avoid replaying encrypted reasoning blocks across sessions or models; follow current vendor guidance on stateless history management and model switching
  • Monitor vendor security advisories from OpenAI, Anthropic, and Google for official confirmation of mitigations and updated API handling guidance